Privacy Policy

Last updated: 2026-10-06

Who's responsible

[Company name] (collectively "we", "us", "the company") is the Data Controller of the personal data we process, under Israel's Privacy Protection Law 5741-1981 as amended by Amendment 13 (in force 14 August 2025), and the EU General Data Protection Regulation (GDPR) where applicable.

Data Protection Officer

Our DPO's contact details are in the footer.

What data we collect

*Information you give us directly:*

- During booking: full name, email, phone, passport details, date of birth, billing address - During contact: name, email, phone, subject and message - During newsletter signup: email address - When leaving a review: name and review text

*Automatic information when you use the site:*

- IP address, browser type, operating system - Pages visited, time spent, navigation path - Session identifiers (cookies) — see separate cookie policy

*From third-party sources:*

- Booking details are received from our reservation engine - Hotel ratings are pulled from the Google Places API

Why we collect it

- **Booking fulfillment** (lawful basis: contract) — issuing vouchers, coordinating with service providers, tracking your booking - **Customer service** (contract / legitimate interest) — answering inquiries, improving service quality - **Newsletter** (consent) — sending offers, only after explicit opt-in - **Site improvement** (legitimate interest + analytics consent) — usage analysis, error tracking, feature development - **Legal obligations** (legal obligation) — retaining booking records for tax audit (7 years)

Who we share data with

- **TravelBooster** — our reservation engine (Israel-based). Receives full booking details to fulfill the service. - **Airlines, hotels, tour operators** — via TravelBooster. Receive only the details necessary for their specific service. - **Our hosting provider** — hosts the website. Where hosting is outside Israel, data transfer is governed by Standard Contractual Clauses (SCCs). - **Google LLC** — Places and Maps services. No identifying personal data shared, only destination names. - **Tax and legal authorities** — if required by law.

Cross-border data transfers

Some of our providers operate outside Israel. Under Israeli privacy law, transfer of personal data abroad is permitted when needed for service delivery and subject to contractual protections. Israel was recognized in 2024 as an Adequacy country by the European Union.

How long we keep data

- **Bookings** — 7 years (tax recordkeeping obligation). After 7 years, we anonymize (replace identifying details with hashes) and keep for statistical purposes only. - **Service inquiries** — 2 years from receipt. - **Newsletter** — until you unsubscribe + 30 day grace period. - **Reviews** — indefinitely (published content), unless you request removal of your name.

Your rights

Under Israel's Privacy Protection Law (Amendment 13) and the EU GDPR, you have the following rights: - **Right of access** (§13) — receive a copy of all data we hold on you - **Right of rectification** (§14) — ask us to correct inaccurate data - **Right to be forgotten** (§14(d)) — request deletion (subject to legal retention obligations) - **Right to portability** — receive data in a portable format - **Right to object** — to processing for direct marketing purposes - **Right to withdraw consent** — for any consent-based processing, at any time

To exercise any right — go to the "My data" page on the site (/my-data) or contact the Data Protection Officer.

Security

We follow the Israeli Privacy Protection (Information Security) Regulations 5777-2017. Our security measures include: in-transit encryption (HTTPS), role-based access controls, access logging, periodic backup, and periodic security audits.

Cookies

We use cookies necessary for site function. Analytics and marketing cookies load only after your consent. You can accept, reject, or customize at any time — via "Privacy settings" in the footer.

Children

The site is not intended for children under 16. We do not knowingly collect data from children under 16. Parents who find that their child has provided us with data should contact us and we will remove it immediately.

Filing a complaint

If you have a complaint about how we handle your data, you may file with the Israeli Privacy Protection Authority at the Ministry of Justice: https://www.gov.il/en/departments/the_privacy_protection_authority

EU residents may also contact their local Supervisory Authority.

Changes to this policy

We may update this policy. Material changes will be posted on the site and emailed to subscribers.

For questions — contact our DPO (details in the footer).